feat(analysis): plumbing sieve + candidate_business tag (deterministic, advisory)

[theagenticguy]

Summary

Two deterministic, label-free per-symbol tags for @opencodehub/analysis, the two halves of one idea:

• classifyPlumbing (precision-first) — flags high-confidence plumbing (serialization, DTO mapping, transport, DI wiring), abstains otherwise. Never asserts "business logic". Plumbing precision 0.936 aggregate, ≥0.85 on every repo (flask 1.00, java 0.94, go 0.92, cosmic 0.89) under per-repo eval.
• classifyBusinessCandidate (recall-first) — the exact complement: a symbol is a candidate_business unless the sieve is confident it's plumbing. Business recall 0.925 (misses 6 of 80), per-repo 0.80–1.00. This is the "look here for domain logic" tag the user gets at analyze time with no query.

Why this shape

Asserting "this IS business logic" needs a trained classifier and didn't generalize across repos (held-out F1 ~0.3). Subtracting confident plumbing does generalize, because the sieve does. So:

likely_plumbing    — sieve, precision-first (0.94)   "this is plumbing"
candidate_business — !likely_plumbing, recall-first (0.925)  "look here for domain logic"

Recall-first by construction: a symbol only loses the candidate tag when we're confident it's plumbing, so real domain logic can't be silently dropped. The 0.385 candidate precision (tags ~67%) is the intended trade — the tag is the safety net; an optional embedding-derived business_rank (follow-up) orders candidates so the most domain-like surface first. Embeddings become a rank, not a yes/no judge.

Provenance

Distilled from a teacher/student loop — a 3-model LLM panel labeled ~300 symbols across Python/Java/Go, a shallow tree was fit, the cleanest high-precision plumbing leaves were lifted out. Both kernels are pure functions of a small PlumbingFeatures struct (no I/O, no model, no randomness — mirrors page-rank.ts), so verdicts are safe to persist into nodes.payload and survive the graphHash byte-identity contract. The complement invariant (every symbol is either confident-plumbing or a candidate, never both/neither) is pinned by test.

End-user flow (unchanged)

codehub init + codehub analyze [--embeddings]. The tags land in nodes.payload, queryable as payload->>'$.candidate_business'. No labeling, ever — labeling was only the offline method-validation, it does not ship.

Scope

• This PR: both kernels + types + 14 unit tests (incl. pinned regressions: AbstractRepository → plumbing, Batch.allocate → candidate), exported from the package index.
• Follow-up: wire the analyze-time pass that computes PlumbingFeatures from the AST and writes likely_plumbing + candidate_business (+ optional embedding business_rank) into nodes.payload.

Also refreshes the stale sql MCP tool description in CLAUDE.md to ADR 0019.

Verification

• packages/analysis typecheck clean; full suite 154 pass / 0 fail.
• banned-strings + commitlint + pre-push test hook all pass.